C2Looper Rust Backdoor, Operation QUICSILVER & ASTERIX: OTX Pulse Analysis — GitHub C2, QUIC Exfiltration & Crypto-Vishing Detection Pack

---
title: C2Looper ClickFix Execution and DLL Sideloading
id: 8f3a1c2e-4b5d-4e7a-9c1f-2a3b4c5d6e7f
status: experimental
description: Detects ClickFix-style user-executed commands and DLL sideloading patterns associated with C2Looper Rust-based backdoor delivery
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
 detection:
    selection_clickfix:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'iex'
            - 'Invoke-WebRequest'
            - 'curl'
            - 'DownloadString'
            - 'FromBase64String'
    selection_rust_artifact:
        CommandLine|contains:
            - '45.158.196'
    condition: selection_clickfix or selection_rust_artifact
falsepositives:
    - Legitimate admin scripting launched from explorer context menus (rare)
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1204
    - attack.t1574.002
---
title: QUIC C2 Over Cloudflare Workers or Non-Standard QUIC Egress
id: 1d2e3f4a-5b6c-7d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects QUIC (UDP/443) network connections from non-browser processes, consistent with QUICAgent Go backdoor C2 via Cloudflare Workers
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
    product: windows
detection:
    selection_quic:
        DestinationPort: 443
        Protocol: udp
        Initiated: 'true'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection_quic and not filter_browsers
falsepositives:
    - Go-based legitimate applications using HTTP/3
    - Some VPN clients and updater services
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102
---
title: Fake Cryptocurrency Wallet Application Execution
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of Electron-based fake wallet applications (Ledger, Trezor, Exodus impersonators) associated with Operation ASTERIX seed-phrase theft
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_wallet_names:
        Image|contains:
            - 'Ledger'
            - 'Trezor'
            - 'Exodus'
    selection_suspicious_path:
        Image|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Downloads\'
            - '\Public\'
    selection_c2:
        CommandLine|contains:
            - 'ledgerhelp.com'
            - '136.0.213.184'
    condition: (selection_wallet_names and selection_suspicious_path) or selection_c2
falsepositives:
    - Legitimate wallet apps installed under AppData by default — validate code signature before dismissing
level: critical
tags:
    - attack.credential_access
    - attack.t1555
    - attack.t1056
    - attack.execution

// Unified hunt: C2Looper, QUICSILVER, and ASTERIX indicators + behaviors
let C2LooperIPs = dynamic(["45.158.196.184", "45.158.196.23"]);
let AsterixIP = "136.0.213.184";
let AsterixDomain = "ledgerhelp.com";
let PulseHashes = dynamic([
    "f59f32c9af4fa8a5dbd4668df8893593bc0c4324816cbf9b956acedcbfb8cdb6",
    "f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b",
    "20675a659c338f7267fd09bacb431f4491f061d3acf42d07aca2dec3d25fa549",
    "c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02",
    "0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39"
]);
union isfuzzy=true
    // Network IOC hits
    (DeviceNetworkEvents
    | where RemoteIP in~ (C2LooperIPs) or RemoteIP == AsterixIP
       or RemoteUrl has AsterixDomain
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort),
    // QUIC from non-browser processes (QUICAgent behavior)
    (DeviceNetworkEvents
    | where RemotePort == 443
    | where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe")
    | where InitiatingProcessFileName has_any ("go", "agent", "quic")
       or InitiatingProcessFolderPath has_any ("\Temp\", "\AppData\Roaming\")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemoteUrl),
    // ClickFix-style process chains (C2Looper delivery)
    (DeviceProcessEvents
    | where InitiatingProcessFileName in~ ("explorer.exe","msedge.exe","chrome.exe")
    | where FileName in~ ("powershell.exe","mshta.exe","rundll32.exe","cmd.exe")
    | where ProcessCommandLine has_any ("iex", "DownloadString", "FromBase64String", "curl ")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName),
    // VHD mount events (QUICSILVER delivery)
    (DeviceProcessEvents
    | where ProcessCommandLine has_any (".vhd", ".vhdx")
    | where FileName in~ ("powershell.exe","diskpart.exe") or ProcessCommandLine has "Mount-VHD"
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine),
    // Hash hits
    (DeviceFileEvents
    | where SHA256 in~ (PulseHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256)
| sort by TimeGenerated desc

# Security Arsenal — C2Looper / QUICSILVER / ASTERIX Endpoint IOC Hunt
# Run elevated on suspected endpoints. Outputs consolidated findings to CSV.

$findings = @()

# --- 1. Network connections to pulse IOCs ---
$badIPs = @('45.158.196.184','45.158.196.23','136.0.213.184')
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $_.RemoteAddress -in $badIPs
} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $findings += [PSCustomObject]@{
        Type='NetworkIOC'; Host=$env:COMPUTERNAME
        Detail="Conn to $($_.RemoteAddress):$($_.RemotePort) by $($proc.ProcessName) ($($proc.Path))"
    }
}

# --- 2. QUIC (UDP/443) listeners/senders from non-browser processes ---
Get-NetUDPEndpoint -ErrorAction SilentlyContinue | Where-Object {
    $_.LocalPort -eq 443
} | ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p.ProcessName -notmatch 'chrome|msedge|firefox|brave') {
        $findings += [PSCustomObject]@{
            Type='SuspiciousQUIC'; Host=$env:COMPUTERNAME
            Detail="UDP/443 held by $($p.ProcessName) at $($p.Path)"
        }
    }
}

# --- 3. Persistence artifacts: Run keys, scheduled tasks with suspicious paths ---
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Value -match 'Temp|AppData|Public|rundll32|mshta|powershell'
            } | ForEach-Object {
                $findings += [PSCustomObject]@{
                    Type='Persistence'; Host=$env:COMPUTERNAME
                    Detail="$key :: $($_.Name) = $($_.Value)"
                }
            }
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match 'powershell|mshta|rundll32' -and
    $_.TaskPath -notmatch '\\Microsoft\\'
} | ForEach-Object {
    $findings += [PSCustomObject]@{
        Type='SuspiciousTask'; Host=$env:COMPUTERNAME
        Detail="Task $($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"
    }
}

# --- 4. Fake wallet apps in user-writable paths (ASTERIX) ---
$walletPaths = @(
    "$env:LOCALAPPDATA\Programs", "$env:APPDATA", "$env:USERPROFILE\Downloads", 'C:\Users\Public'
)
foreach ($path in $walletPaths) {
    Get-ChildItem $path -Recurse -Include '*Ledger*','*Trezor*','*Exodus*' -ErrorAction SilentlyContinue |
        Where-Object { $_.Extension -in '.exe','.msi' } | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            if ($sig.Status -ne 'Valid') {
                $findings += [PSCustomObject]@{
                    Type='FakeWalletApp'; Host=$env:COMPUTERNAME
                    Detail="$($_.FullName) [sig: $($sig.Status), sha256: $((Get-FileHash $_.FullName -Algorithm SHA256).Hash)]"
                }
            }
        }
}

# --- 5. Recently mounted VHD/VHDX evidence (QUICSILVER) ---
Get-ChildItem "$env:USERPROFILE\Downloads", "$env:TEMP" -Recurse -Include '*.vhd','*.vhdx' -ErrorAction SilentlyContinue |
    ForEach-Object {
        $findings += [PSCustomObject]@{
            Type='SuspiciousVHD'; Host=$env:COMPUTERNAME
            Detail="$($_.FullName) created $($_.CreationTime)"
        }
    }

$findings | Format-Table -AutoSize
$findings | Export-Csv ".\pulse_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($findings.Count) finding(s) exported."